Qilin

Qilin, a threat actor in the cybersecurity landscape, has emerged as a significant player in the ransomware space. The Octo Tempest group recently added Qilin ransomware to its arsenal, enhancing its capabilities and reach. This addition suggests that high-level groups like Qilin may have the capacity for turnkey jobs and often partner with initial access brokers (IABs) to facilitate their operations. In one observed instance, the Qilin ransomware gang breached its target through a VPN portal, demonstrating its sophisticated attack methods. The Qilin ransomware has shown an aggressive streak with its victim count increasing by 44% to reach 140 in Q3. It has claimed attacks on several high-profile targets, including the automotive giant Yanfeng. Interestingly, the rise of Qilin and similar ransomware like RansomHub appears to have come at the expense of LockBit, which had boasted three times more successful attacks than its closest rival Qilin in the second quarter. However, the tables seem to have turned, with Qilin's fortunes on the rise. Despite its escalating activities, Qilin has faced legal challenges. In August, Synnovis obtained a preliminary injunction from the English High Court against the Qilin ransomware group, Telegram, and a leak site to prevent the publication of stolen data. This led to Telegram blocking the channel used by Qilin to leak the stolen data from its victims. Nonetheless, Qilin continues to be a formidable force in the ransomware arena, requiring continued vigilance and robust cybersecurity measures.